diff --git a/defaults/main.yaml b/defaults/main.yaml
index 3c62560..bea6f6f 100644
--- a/defaults/main.yaml
+++ b/defaults/main.yaml
@@ -35,6 +35,7 @@ eralitex_applications:
   m: "{{eralitex_mail_command}}"
   r: arandr
 
+ssh_over_tor: false
 
 eralitex_lock_command: xset s activate
 eralitex_enable_screensaver_command: /usr/local/bin/screensaver-enable
diff --git a/templates/ssh.config.j2 b/templates/ssh.config.j2
index 77ce8a7..b334345 100644
--- a/templates/ssh.config.j2
+++ b/templates/ssh.config.j2
@@ -1,6 +1,9 @@
-{% for hostname in groups.vms %}
+{% for hostname in groups.all %}
 Host {{hostname}}
-{% if 'external_ip' in hostvars[hostname] %}
+{% if ssh_over_tor and ('ansible_local' in hostvars[hostname]) and ('tor' in hostvars[hostname].ansible_local) and ('ssh' in hostvars[hostname].ansible_local.tor.tor_hidden_services_hostnames) %}
+  HostName {{hostvars[hostname].ansible_local.tor.tor_hidden_services_hostnames.ssh}}
+  ProxyCommand nc -x 127.0.0.1:9050 -X5 %h %p
+{% elif 'external_ip' in hostvars[hostname] %}
   HostName {{hostvars[hostname].external_ip}}
 {% endif %}
 {% endfor %}